GhostAction workflows in 790 GitHub repos hunt cloud and AI keys
OpenSourceMalware's count through October 9 is validated public repos, not proof that every one leaked secrets.
74
Malware
GhostAction
- Mentions · 7d1
- Mentions · 30d2
- All mentions2
- First seenOct 9, 2026
- Last mentioned5d ago
Timeline
2 articles · newest firstNew GhostAction Attack Compromises Hundreds of GitHub Repos to Steal Secrets
GhostAction hit 346 GitHub repositories, including Uber's, with malicious Actions workflows that stole CI secrets.
82
Appears with
- GitHub Actionsproduct · 2
- Socketorganization · 2
- Ubervictim · 2
- GitGuardianorganization · 2
- PyPIproduct · 2
- GitHubvendor · 2
- kitao/pyxelvictim · 1
- OpenSourceMalwareorganization · 1
- npmproduct · 1
- Uberorganization · 1
- GhostActionthreat actor · 1
- StepSecurityorganization · 1
- GitHuborganization · 1
- crates.ioproduct · 1
- Docker Hubproduct · 1
- claudecordmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.